Jupiter

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.229.15
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-07 22:20 EDT
Nmap scan report for 10.129.229.15
Host is up (0.016s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

We have to add jupiter.htb to our /etc/hosts file to view port 80.

Web Enum -> Subdomain

The website was a typical corporate site:

There was nothing inherently interesting about the website itself, so I ran a directory and subdomain scan on it. A wfuzz subdomain scan found this:

There's a kiosk endpoint. When visited, it shows a Grafana dashboard:

API SQL Injection

When viewing the traffic in Burp, we can see a lot of requests sent to an /api endpoint:

I viewed the requests and found this query request:

This query was sending a query to the backend database, and it look like it's vulnerable to SQL injection. We can attempt the PostGreSQL RCE exploit, which involves creating a table cmd_exec.

Now, we just need to execute a reverse shell with this query:

Then, we would catch a reverse shell on a listener port:

Privilege Escalation

We are a low privilege user here, so we cannot grab any user flags just yet.

Network Simulation -> RCE

There is something in the machine killing upgraded pty shells, and I don't know what. Anyways, I ran a pspy64 within the machine to find out if any processes were being run as the user.

There was a .yml file being used to run something in the background as the user. Here's the contents of that file:

This file was being used to run some commands, and we have write access over it. As such, we can easily create another one of it that makes an SUID binary as the user. Here's the updated file:

We can overwrite the existing file using wget -O. Afterwards, we can easily get a user shell:

We can drop our public key into the authorized_keys folder to upgrade our shell.

Jupyter -> Jovian Shell

Now, we need to gain access to the other user, which might have other privileges that we need. Running netstat shows that there are multiple ports open with possible services:

Port 8888 was a HTTP port, so let's do some chisel forwarding. When visited, it shows a Jupyter instance:

There was some token required before we could visit the site. Normally, I'd access this through running jupyter notebook list, but there are Python errors with this method. So, we would have to find the source of this website instead to either fix the error or view the logs to find a token. A bit of enumeration reveals that the /opt directory contains some interesting files:

We can view the logs to find a token:

We can visit the site with the ?token parameter at the end and be brought to a file directory:

When we click 'New', there's an option to create a new Notebook:

This brings us to what seems to be a Python interpreter:

I simply ran a command to generate another SUID binary on the machine.

This gives us an easy shell as the new user:

We can also get a reverse shell using this method by replacing the command run.

Sudo Privileges

First thing we notice is that we are part of the sudo group, so I checked our sudo privileges first:

I wasn't sure what this binary did, but we have write access over it for some reason:

We can just overwrite this with /bin/bash, and then run it using sudo to get an easy root shell.

Rooted!

PreviousJsonNextLazy

Last updated